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Abstract 

Fully homomorphic encryption is a kind of encryption scheme, which en¬ 
ables arbitrary computation on encrypted data without accessing the data. 
We present the quantum version of fully homomorphic encryption scheme, 
which is constructed based on quantum fault-tolerant construction. Two 
schemes are constructed. The hrst is a symmetric scheme, and the secret 
key is the quantum CSS code. In the scheme, when Server performs quan¬ 
tum computation on the encrypted plaintext, some ancillary quantum states 
should be provided by Client. The second is an asymmetric scheme, which 
contains the periodical interaction between Client and Server. 
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1. Introduction 

Fully homomorphic encryption (FHE) is a kind of encryption scheme 
with the homomorphic property. It enables arbitrary computation on en¬ 
crypted plaintext, without decrypting them. FHE is fundamental in the 
theory and application of cryptology, such as secure multiparty computa¬ 
tion, zero-knowledge proof, search encrypted data, outsourcing computing, 
copyright protection. For many years, the researchers yearn for a construc- 
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tion of FHE scheme. Since Gentry [1] sucessfully devised a FHE scheme, 
FHE becomes an important research direction in cryptology. 

Quantum fully homomorphic encryption (QFHE) [2] represents a quan¬ 
tum version of FHE. Generally, QFHE is a kind of FHE scheme which is 
realized through quantum computing technology. Similar with the classical 
FHE, a QFHE has four algorithms: key generation algorithm, encryption al¬ 
gorithm, decryption algorithm, evaluation algorithm. The difference between 
QFHE and FHE is the computing model. FHE is established under the model 
of polynomial-time probabilistic computation, while QFHE is dehned by the 
model of polynomial-time quantum computation. 

In 2012, Rohde et ah [3] proposed a symmetric quantum homomorphic 
encryption scheme, which permits quantum random walk on encrypted quan¬ 
tum data. However, it is not fully homomorphic. Later, in Ref. [2], QFHE is 
formalized, and a weak symmetric scheme is constructed. By the scheme, the 
encrypted quantum data can be directly used in the quantum computation, 
without decrypting them in advance. However, the scheme is different from 
the commonly mentioned FHE, since the secret key is necessary during the 
computation on encrypted data. 

Recently, Yu et ah [4] proved that, when the perfect security is required, 
quantum homomorphic encryption scheme would need at least log 2 |S'| qubits 
to store the encrypted result, where [S'! denotes the size of the set S {S is the 
set of permitted computation). So, the QFHE scheme with perfect security 
would necessarily incur exponential storage overhead. The QFHE scheme 
proposed in Ref. [5] does not provide the security of cryptographic sense. The 
reason is as follow: it only hides n/logn bits (n is the size of the message), 
then the ratio of the hidden amount to the total amount approaches to 0 
(1/logu —)■ 0) when n approaches to inhnity. Broadbent and Jeffery [6] 
proposed three public-key quantum homomorphic encryption schemes (not 
fully homomorphic), which are constructed by combining quantum one-time 
pad with classical FHE scheme. So, their efficiency and security are bounded 
by classical FHE scheme. 

In modern cryptography, error-correcting code is an important tool in the 
design of cryptosystems, such as McEliece public-key encryption algorithm 
[7] . As a special lattice, error-correcting codes can also be used to construct 
FHE scheme. Similarly, in quantum cryptography, quantum error-correcting 
codes can be used to devise quantum cryptosystems, such as quantum au¬ 
thentication scheme [8] and Fujita’s public-key encryption scheme [9]. In 
addition, we also have proposed a quantum McEliece public-key encryption 
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scheme [10-12] based on error-correcting codes. In this article, we shall devise 
a QFHE scheme based on quantum fault-tolerant construction. 

2. Quantum fully homomorphic encryption scheme 

2.1. Symmetric scheme 

CSS code is an important kinds of quantum error-correcting codes, and 
plays the fundamental role in fault-tolerant quantum computation. We devise 
QFHE scheme based on CSS codes, for the reason that it has good property in 
fault-tolerant quantum computation: after encoding quantum states through 
CSS codes, the quantum operation on logical qubit can be implemented by 
transversal quantum operations on physical qubits. For example, the fault- 
tolerant H gate and CNOT gate can be implemented by transversal H gates 
and transversal CNOT gates, respectively. The fault-tolerant S gate can 
be implemented by transversal S~^ gates. Thus, when the code-length is 
known, the fault-tolerant H, CNOT, S gates can be carried out without any 
information about the code. In fault-tolerant quantum computation, the T 
(or vr/S) gate can also be implemented transversally, however, an ancillary 
state is necessary, which is relative to the CSS code. See Ref. [13] for more 
details. 

Firstly, we should determine a value of security parameter n. For a given 
value n, there exists 2n — 1 kinds of [[n, 1]] quantum CSS codes. Denote Qn 
as the set of all [[n, 1]] quantum CSS codes. The size of Qn is \Qn\ = 2"'“F 

Next, we present a symmetric QFHE scheme based on the set Qn. The se¬ 
cret key is selected from the set Qn, and is used in the encryption/decryption 
algorithms. The scheme contains the following four algorithms. 

• Key generation algorithm 

Alice randomly selects a CSS code from the set Qn. The CSS code is 
used as the secret key. Denote it as sk. We suggest the following two 
ways to randomly select the secret key. 

1. Similar to the key generation algorithm of Fujita’s public-key en¬ 
cryption scheme [9], Alice selects a CSS code of generator matrix 
G from Qn, and randomly selects a nonsingular binary matrix S 
and a permutation matrix P (The concrete parameter and form 
of these matrixes can be referred in [9]). Then, Alice computes 
G = SGP, which is a generator matrix of another CSS code in 
Qn. G is used as the secret key. 
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2. In the other way, it uses a family of CSS codes with parameters 
u and V, denoted as {CSSu,v{Ci,C 2 ).,u,v G {0,1}"'} [13]. Firstly, 
Alice determines a CSS code CSS{Ci,C 2 ), then randomly selects 
two random numbers u and v. The CSS code CSSu,v{.Ci,C 2 ) is 
used as the secret key. 

• Encryption algorithm 

According to the secret key sk (a CSS code), Alice performs CSS en¬ 
coding on quantum plaintext p, 

a = Encskip), (1) 

and each qubit is encoded into n cipher qubits. The quantum circuit for 
encoding can be constructed from the standard form of the generator 
matrix for a stabilizer code [14]. 

• Evaluation algorithm 

Denote QC as Bob’s quantum computation and QC as its fault-tolerant 
version. Bob does not know the secret key, which is the encoding 
scheme of CSS code. He performs fault-tolerant quantum computa¬ 
tion QC on encoded quantum data a, and obtains the encoded result 
a' = QC{a), which equals to EnCskiQC{p)). The details are as follows. 
The set (H, CNOT, T} is a universal set of gates for quantum computa¬ 
tion, so any quantum computation can be described by a quantum 
circuit consisting of the H,CNOT,T gates. According to the quantum 
circuit. Bob performs quantum computation on encrypted states in the 
following ways. 

1. If Bob intends to perform an H (or CNOT) gate on the Ah (or 
i, jth) logical qubits of the plaintext p, he should perform a fault- 
tolerant H (or CNOT) gate on the corresponding physical qubits 
of the encrypted states a. The fault-tolerant H (or CNOT) has n 
transversal H (or CNOT) gates, denoted as H (or CNOT). 

H{EnCsk{p)) = EnCskiKp)): ( 2 ) 

CNOT{EnCsk{p)) = Enc^fc(CN0T(p)). (3) 

2. If Bob intends to perform a T gate on the Ah logical qubit of the 
plaintext p, he needs an ancillary state |0) which depends on the 
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secret key (or the CSS code) sk. Because sk is private for Bob, 
the ancillary state must be provided by Alice. Alice can produce 
the ancillary state by encrypting a qubit (|0) -\-exp{i'K/A)\l))/\/2\ 


| 0 ) 


E^^ \a)+exp^^H)\l) y 


( 4 ) 


To avoid interactive process between Alice and Bob, the ancillary 
state |0) should be prepared when Alice performs the encryption 
algorithm, and be sent to Bob together with the encoded state a. 
According to the implementation of fault-tolerant T gate [13], by 
using the ancillary state, the T gate on the logical qubit can also 
be implemented by n transversal CNOT gates and n transversal 
gates. 


• Decryption algorithm 

Denote a' as the obtained result after hnishing the Evaluation algo¬ 
rithm on the encrypted state a. According to the secret key sk (a CSS 
code), Alice performs CSS decoding on quantum ciphertext a' 

p' = Decsk{(y'), (5) 

then every n cipher qubits are decoded into single plain qubit. The 
quantum circuit for decoding can be constructed from the standard 
form of the generator matrix for a stabilizer code [14] . 

Until now, we have completely described a symmetric QFHE scheme. Its 
correctness (or p' = QC{p)) can be deduced from fault-tolerant quantum 
computation 

QC{EnCsk{,p)) = EnCsk{QC{p)), ( 6 ) 

where QC represents the quantum computation on encoded qubits or physical 
qubits, and QC represents the quantum computation on logical qubits. 

It is worth to notice that, the ancillary state |0) depends on the CSS 
code, which is Alice’s secret key. Thus, the ancillary state |0) should be 
provided by Alice, and their amount depends on the number of T gates 
in Bob’s quantum computation QC. To avoid interactive computing, Alice 
should provide enough ancillary states when she sends the encrypted state a 
to Bob. 
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Another thing that should be noticed is, our QFHE scheme is constructed 
based on quantum fault-tolerant construction, however, it is unnecessary to 
periodically perform error-correction procedure. 

It can be known from our construction that, the security is independent 
of any computational hard problems. Finally, we analyze the security of the 
QFHE scheme. 

Alice’s secret key sk is a quantum CSS code in the attacker does not 
know which CSS code is selected by Alice. There may be two possible ways 
to attack the scheme: (l)Decrypt the cipher state through CSS decoding, 
(2)Decrypt the ancillary state |0) through CSS decoding. In the hrst case, 
the attacker knows neither the plain state nor the CSS code sk. Thus, even 
if he guesses the secret key sk correctly, he cannot judge whether he has at¬ 
tacked successfully. In the second case, the attacker can decode the ancillary 
state, and compare the decoded state with (|0) -1- exp{m/A)\l))/\/2, then 
he can know whether he succeed. So, the focus of the security is the total 
amount of [[n, 1]] quantum CSS codes. Because the total number of [[n, 1]] 
quantum CSS codes is 2"'“^, when n is large enough, the attack will succeed 
with an exponentially small probability. Because the ancillary state contains 
some information about the CSS code s/c, the attacker can determine sk from 
sufficiently more ancillary states. In the practice, Alice should predict how 
many T gates would be in the quantum circuit QC, and select a large enough 
security parameter n. Then the attacker cannot obtain enough information 
about sk by measuring these ancillary states. 

The theoretical analysis of the security about the QFHE scheme will be 
given in the full paper. 

2.2. Asymmetric scheme 

We have proposed a symmetric QFHE scheme. How to construct an 
asymmetric scheme? In this section, we try to solve the problem based on 
quantum CSS codes. Similar to Fujita’s public-key cryptosystems [9], random 
errors are added to the encoded quantum state while encrypting the state. 
However, this would cause a problem: when Bob performs nonlocal quantum 
computation on the cipher state, the random errors would propagate between 
different logical qubits (a logical qubit is a block of physical qubits). The 
errors in single logical qubit maybe increase and hnally cause the failure 
of decryption. Similar to the periodically error-correction in fault-tolerant 
quantum computation, we can solve the problem by periodical interaction: 
when Bob hnishes a period of quantum computation on encrypted data, he 
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sends the outcome to Alice; Alice decrypts it and encrypts it again, then she 
sends the new cipher state to Bob; Bob begins the next period of quantum 
computation. 

• Key generation algorithm 

Alice determines the private key {S,G,P) (It is the same as Ref. [9]), 
and computes G = SGP. G can determine a CSS code. The CSS 
code can correct up to t errors. Then the public key is {G,ct), where 
c G (0,1) is a constant number. 

• Encryption algorithm 

According to the public key G, Alice encodes the quantum plaintext 
p, and randomly adds ct Pauli errors (denoted as P^) on the encoded 
state, 

p = Pct{Encodep;{p)). (7) 

Then she sends the cipher state p' to Bob. 

• Evaluation algorithm 

Assume Bob’s quantum computation has been represented as a quan¬ 
tum circuit QG consisting of H, T, CNOT gates. After receiving the 
cipher state p' from Alice, Bob begins to perform the quantum gates 
in his circuit according to the public key G. For the different gates, he 
performs in the following different ways. 

1. For the H gate. Bob performs the fault-tolerant Hadamard gate 
H according to the CSS code G. H is n transversal H gates. 

H Pet {Encode q{p)) = P'etH {Encode q{p)) = Pe^{EncodeQ{H {p))), 

( 8 ) 

where P^t denotes another ct Pauli errors. The positions of the ct 
Pauli errors are the same as Pef 

2. For the T gate. Bob prepares an ancillary state |0) according to 
the CSS code G. Then he performs the fault-tolerant T gate. 

3. For the CNOT gate, when Bob performs a fault-tolerant CNOT 
gate, the Pauli errors will increase. When the total errors increase 
to t, Bob returns the outcome to Alice. According to the private 
key {S,G,P), Alice decrypts it. Then she encrypts it again, and 
sends to Bob. Bob continues the unhnished quantum computa¬ 
tion. 
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Performing the above interactive procedure until Bob finishes the whole 
quantum circuit. 

• Decryption algorithm 

According to the private key {S,G,P), Alice can decrypt the cipher 
state. See Ref. [9] for the details. 

This asymmetric scheme is computationally secure. Its formal description 
and strict security analysis will be given in the full paper. 

3. Discussions 

In the asymmetric QFHE scheme, random Pauli errors are introduced to 
realize the encryption, and the interaction between Alice and Bob is intro¬ 
duced to control the increase of the errors. To avoid the interactive process, 
one possible solution is the quantum bootstrapping, which is similar to the 
bootstrapping in classical FHE. The quantum bootstrapping is still under 
consideration now. 

The encoder of any quantum CSS code cannot commute with arbitrary 
quantum operator. From the fault-tolerant quantum computation, we know 
the commutative rules between the H (or CNOT) gate and any CSS encoder 


EtICcss' 


H{EnCcss{p)) = EnCcss{H{p)),Wp, 


(9) 

( 10 ) 


CNOT{Enc,M) = Enc,ss{C NOT{p)),^ p. 


However, in the universal set {hf, CNOT, T}, only the T gate does not satisfy 
the above relation. So, an ancillary state is employed for the T gate in the 
symmetric scheme. While in the asymmetric scheme, the interactive process 
between Alice and Bob is used. We guess that, in the construction of QFHE 
scheme, it is necessary that Alice provides ancillary computation for Bob. 

4. Conclusions 

Based on quantum fault-tolerant construction, this paper presents two 
QFHE schemes. In the symmetric scheme, the CSS code is used as the secret 
key for encryption and decryption. Quantum fault-tolerant construction is 
adopted during the computing on encrypted states, however there has not 
any periodical error-correct ion and no interaction is needed. The security of 



the scheme does not depend on any computational hard problems. In the 
asymmetric scheme, interaction between Alice and Bob is necessary, and the 
security relies on NP-complete problem. 
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